Understanding the combination of ufw --force enable
I rent a remote machine with Debian/Ubuntu and desire to filter all ports I don't use through iptables via ufw.
The only ports I allow (both with TCP and UPD) are 22,25,80,443.
If I understand man ufw correctly ufw usually uses for interactive-usage and if we want to use it non-interactively we must "force" such usage. Hence:
- In Bash script, the syntax
ufw --forceenables it for non interactive usage. - By adding
enableright afterwards (as to getufw --force enable) we both reset the firewall and also makeufwto recursively being booted after the OS boots.
Is that correct?
debian arguments ufw
asked Dec 14 '18 at 17:48
JohnDoea
1031132
add a comment |
I rent a remote machine with Debian/Ubuntu and desire to filter all ports I don't use through iptables via ufw.
The only ports I allow (both with TCP and UPD) are 22,25,80,443.
If I understand man ufw correctly ufw usually uses for interactive-usage and if we want to use it non-interactively we must "force" such usage. Hence:
- In Bash script, the syntax
ufw --forceenables it for non interactive usage. - By adding
enableright afterwards (as to getufw --force enable) we both reset the firewall and also makeufwto recursively being booted after the OS boots.
Is that correct?
debian arguments ufw
asked Dec 14 '18 at 17:48
JohnDoea
1031132
add a comment |
I rent a remote machine with Debian/Ubuntu and desire to filter all ports I don't use through iptables via ufw.
The only ports I allow (both with TCP and UPD) are 22,25,80,443.
If I understand man ufw correctly ufw usually uses for interactive-usage and if we want to use it non-interactively we must "force" such usage. Hence:
- In Bash script, the syntax
ufw --forceenables it for non interactive usage. - By adding
enableright afterwards (as to getufw --force enable) we both reset the firewall and also makeufwto recursively being booted after the OS boots.
Is that correct?
debian arguments ufw
asked Dec 14 '18 at 17:48
JohnDoea
1031132
I rent a remote machine with Debian/Ubuntu and desire to filter all ports I don't use through iptables via ufw.
The only ports I allow (both with TCP and UPD) are 22,25,80,443.
If I understand man ufw correctly ufw usually uses for interactive-usage and if we want to use it non-interactively we must "force" such usage. Hence:
- In Bash script, the syntax
ufw --forceenables it for non interactive usage. - By adding
enableright afterwards (as to getufw --force enable) we both reset the firewall and also makeufwto recursively being booted after the OS boots.
Is that correct?
debian arguments ufw
debian arguments ufw
asked Dec 14 '18 at 17:48
JohnDoea
1031132
asked Dec 14 '18 at 17:48
JohnDoea
1031132
edited Dec 19 '18 at 7:01
asked Dec 14 '18 at 17:48
JohnDoea
1031132
asked Dec 14 '18 at 17:48
JohnDoea
1031132
asked Dec 14 '18 at 17:48
JohnDoea
1031132
1031132
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
Yes, you are correct. Have a look at the man page of ufw using man ufw. Under REMOTE MANAGEMENT they say:
When running ufw enable or starting ufw via its initscript, ufw
will flush its chains.
This is required so ufw can maintain a consistent state, but it may drop existing
connections (eg ssh). ufw does support adding rules before enabling the firewall, so
administrators can do:
ufw allow proto tcp from any to any port 22
before running 'ufw enable'. The rules will still be flushed, but the ssh port will be
open after enabling the firewall. Please note that once ufw is 'enabled', ufw will not
flush the chains when adding or removing rules (but will when modifying a rule or changing
the default policy). By default, ufw will prompt when enabling the firewall while running
under ssh. This can be disabled by using 'ufw --force enable'.
answered Dec 19 '18 at 7:58
koongfoopoodle
262
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "106"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: false,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: null,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f488033%2funderstanding-the-combination-of-ufw-force-enable%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
Yes, you are correct. Have a look at the man page of ufw using man ufw. Under REMOTE MANAGEMENT they say:
When running ufw enable or starting ufw via its initscript, ufw
will flush its chains.
This is required so ufw can maintain a consistent state, but it may drop existing
connections (eg ssh). ufw does support adding rules before enabling the firewall, so
administrators can do:
ufw allow proto tcp from any to any port 22
before running 'ufw enable'. The rules will still be flushed, but the ssh port will be
open after enabling the firewall. Please note that once ufw is 'enabled', ufw will not
flush the chains when adding or removing rules (but will when modifying a rule or changing
the default policy). By default, ufw will prompt when enabling the firewall while running
under ssh. This can be disabled by using 'ufw --force enable'.
answered Dec 19 '18 at 7:58
koongfoopoodle
262
add a comment |
Yes, you are correct. Have a look at the man page of ufw using man ufw. Under REMOTE MANAGEMENT they say:
When running ufw enable or starting ufw via its initscript, ufw
will flush its chains.
This is required so ufw can maintain a consistent state, but it may drop existing
connections (eg ssh). ufw does support adding rules before enabling the firewall, so
administrators can do:
ufw allow proto tcp from any to any port 22
before running 'ufw enable'. The rules will still be flushed, but the ssh port will be
open after enabling the firewall. Please note that once ufw is 'enabled', ufw will not
flush the chains when adding or removing rules (but will when modifying a rule or changing
the default policy). By default, ufw will prompt when enabling the firewall while running
under ssh. This can be disabled by using 'ufw --force enable'.
answered Dec 19 '18 at 7:58
koongfoopoodle
262
add a comment |
Yes, you are correct. Have a look at the man page of ufw using man ufw. Under REMOTE MANAGEMENT they say:
When running ufw enable or starting ufw via its initscript, ufw
will flush its chains.
This is required so ufw can maintain a consistent state, but it may drop existing
connections (eg ssh). ufw does support adding rules before enabling the firewall, so
administrators can do:
ufw allow proto tcp from any to any port 22
before running 'ufw enable'. The rules will still be flushed, but the ssh port will be
open after enabling the firewall. Please note that once ufw is 'enabled', ufw will not
flush the chains when adding or removing rules (but will when modifying a rule or changing
the default policy). By default, ufw will prompt when enabling the firewall while running
under ssh. This can be disabled by using 'ufw --force enable'.
answered Dec 19 '18 at 7:58
koongfoopoodle
262
Yes, you are correct. Have a look at the man page of ufw using man ufw. Under REMOTE MANAGEMENT they say:
When running ufw enable or starting ufw via its initscript, ufw
will flush its chains.
This is required so ufw can maintain a consistent state, but it may drop existing
connections (eg ssh). ufw does support adding rules before enabling the firewall, so
administrators can do:
ufw allow proto tcp from any to any port 22
before running 'ufw enable'. The rules will still be flushed, but the ssh port will be
open after enabling the firewall. Please note that once ufw is 'enabled', ufw will not
flush the chains when adding or removing rules (but will when modifying a rule or changing
the default policy). By default, ufw will prompt when enabling the firewall while running
under ssh. This can be disabled by using 'ufw --force enable'.
answered Dec 19 '18 at 7:58
koongfoopoodle
262
answered Dec 19 '18 at 7:58
koongfoopoodle
262
answered Dec 19 '18 at 7:58
koongfoopoodle
262
answered Dec 19 '18 at 7:58
koongfoopoodle
262
262
add a comment |
add a comment |
Thanks for contributing an answer to Unix & Linux Stack Exchange!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f488033%2funderstanding-the-combination-of-ufw-force-enable%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
